State-backed ‘GoldenJackal’ hackers deploy new tools against government entities

Researchers at ESET uncovered previously undocumented, highly modular toolsets used by the GoldenJackal cyberespionage group (active since at least 2019) to compromise and exfiltrate data from air-gapped systems at government and diplomatic organizations in Europe, the Middle East, and South Asia. The group deployed bespoke components for USB monitoring, file collection, network propagation via removable media, targeted email exfiltration, and encrypted containers, indicating high sophistication and resource investment despite limited attribution.